How to modify/replace a non exported function in a native code dll

Question

I disassembled a misbehaving dll with IDA and identified the faulty code. Now I want to go one step further and replace the function with a self-written, hopefully less faulty one. The dll I'm talking about is written in C/C++ and the function in question is not exported.

What would be a practicable way to overwrite/replace this function along with relocation information and all? Everything I found on the net was about rebuilding MSIL dll's.

My guess would be to write a new function in assembler, assemble it, create a new section in the dll, put the code there and somehow introduce a call to the new function at the beginning of the original implementation. But I don't know these steps would exactly look or how to merge the relocation info etc. Or is there a better solution? Are there any primers or tools to help me get such a thing done?

Edit: Meanwhile I found articles about similar topics

• Injecting code into a PE file
• Injecting a C compiled application into a PE file

Answer 1

I think you have 4 options here:

1. Overwrite the function in assembler using OllyDbg, IDA Pro or any other tool. However, you may not have enough space.
2. Insert a jmp to another place where you have enough space to do this. You will likely need to find for "holes" between sections where you can put your code.
3. Add a new section to the PE/ELF file, mark it as executable and then put a jmp in the function you want to overwrite to go to your new code, that will be in the new section. You can make it as big as you need, as long as you rebuild correctly the PE/ELF header.
4. The way I like the most: overwrite the function with the assembly code to load another library, resolve a function exported by this library and call this function. The other library would be one that you can write in the high level language you prefer as long as you take care of the calling conventions, etc...

The option #4 is the best because it allows you to write in high level code your logic and you only need to write in assembler the LoadLibrary (or dlopen), GetProcAddress and the final calling code. And only once. Then you can modify as many times as you want the library with your code.

Answer 2

After putting more thorough thinking into this I decided to go with option 1 in joxeankoret's list. As the main focus of the fix is reordering some actions and the code is interspersed with debug logging calls I might get away with some pc relative short jumps overwriting the debug code.

Some additional info to extend joxeankoret's answer and my comment:

One hardcore solution to the absolute address problem seems to be to completely remove the relocation section.

Another possiblity is to use the Relocation Section Editor to manually edit/add/remove the relocations.

Regarding option 4, there seems to be the possibility to edit the PE import address table to omit the LoadLibrary/GetProcAddress code.